Researchers Show How Root Access on Kubernetes Nodes Can Expose SPIFFE/SPIRE Workload Identities

Summary

Unit 42 demonstrated that an attacker with root access to a Kubernetes node can spoof cgroup data to trick SPIRE into issuing co-located workloads’ identities. Its Spooffe tool automates identity enumeration; Unit 42 reports no in-the-wild exploitation.

Key points

The technique requires root-level access to a compromised Kubernetes node.
An attacker can manipulate cgroup metadata used in SPIRE workload attestation, causing the agent to misidentify the requesting process.
The agent may then issue a co-located workload’s SVID, enabling the attacker to impersonate that workload and access resources that trust its identity.
Unit 42 developed Spooffe to automate cgroup selector spoofing and enumerate workload identities available through the local SPIRE agent.
Unit 42 says it has not observed the technique exploited in the wild.
Recommended mitigations include restricting root access, prohibiting privileged containers and host access, and minimizing reliance on weak selectors.

Article Details

Attack Vectors: An attacker with root access on a compromised Kubernetes node can manipulate cgroup metadata so the SPIRE agent attributes the attacker's process to a co-located workload.
By spoofing workload selectors, the attacker can cause the SPIRE agent to issue that workload's SVID, enabling workload impersonation and access to services or resources that trust the identity.
Spooffe automates discovery of running workloads and cgroup paths, then queries the local SPIRE agent to retrieve workload identities.
Defensive Notes: Treat root-level access to a node as granting access to all cryptographic identities scoped to that node.
Harden nodes, restrict root access, prohibit privileged containers and host access, and minimize reliance on weak or easily spoofed selectors.
The article identifies Cortex XDR and XSIAM, and Cortex Cloud Identity Threat Detection, as protections for the described threats.